Struct AppState 

pub struct AppState {

    pub config: Arc<Config>,
    pub db: AnyPool,
    pub db_ro: AnyPool,
    pub db_kind: DbKind,
    pub cas: Arc<IndexMap<String, Arc<CaState>>>,
    pub default_ca_id: Arc<String>,
    pub otp_store: Option<Arc<OtpStore>>,
    pub hsm: Option<Arc<HsmContext>>,
    pub audit: Arc<AuditState>,
    pub ha_manager: Option<Arc<HaManager>>,
    pub gss_cred: Option<Arc<dyn Any + Send + Sync>>,
    pub star_manager: Option<Arc<StarManager>>,
    pub startup_time: Instant,
}

Top-level application state cloned into every axum handler.

Fields

config: Arc<Config>

Parsed and validated configuration.

db: AnyPool

Primary database connection pool (read-write).

db_ro: AnyPool

Read-only database connection pool.

For SQLite WAL mode, this is a ?mode=ro pool that never acquires the write lock, enabling concurrent reads during writes. For PostgreSQL/MariaDB, this is a clone of db (MVCC handles concurrency natively).

db_kind: DbKind

Database backend discriminant (drives BEGIN IMMEDIATE for SQLite).

cas: Arc<IndexMap<String, Arc<CaState>>>

All CAs keyed by their id, in config declaration order.

default_ca_id: Arc<String>

The CA designated as the default for unlabeled EST requests.

otp_store: Option<Arc<OtpStore>>

OTP store (present when [otp] is enabled).

hsm: Option<Arc<HsmContext>>

HSM context (present when [hsm] is configured).

audit: Arc<AuditState>

Shared audit state (overflow flag, alarm counter).

ha_manager: Option<Arc<HaManager>>

HA manager for multi-CA failover (present when HA is configured).

gss_cred: Option<Arc<dyn Any + Send + Sync>>

Server-side GSSAPI credential for SPNEGO authentication.

None when GSSAPI is not configured. When present, the auth layer uses it to validate Authorization: Negotiate tokens.

star_manager: Option<Arc<StarManager>>

STAR certificate manager (present when [star] is enabled).

Manages active STAR orders and their renewal state (RFC 8739).

startup_time: Instant

Timestamp when the server process started.

Used for uptime reporting in health endpoints and session expiry calculations.

Implementations

impl AppState

pub fn default_ca(&self) -> &Arc<CaState>

Return the default CA state.

Panics

Panics if default_ca_id is not present in cas. This indicates a bug in the startup code — Config::validate() ensures the default CA exists.

pub fn get_ca(&self, ca_id: &str) -> Option<&Arc<CaState>>

Look up a CA by its identifier. Returns None for unknown IDs.

pub fn default_ca_cert_der(&self) -> Option<Vec<u8>>

Returns the DER-encoded certificate of the default CA.

Used by the OCSP client (RFC 6960) to build CertID structures for revocation checking of client certificates (RHELBU-3536 R21). Returns None if no default CA is configured or the cert is empty.

pub async fn record_audit_event(&self, event_type: &str, detail: &str)

Record an audit event, logging (but not propagating) any DB error.

Convenience wrapper that bundles the DB pool and audit state so call sites only need to pass the event type and detail.

Trait Implementations

impl Clone for AppState

fn clone(&self) -> AppState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.